RansNet WAN solutions can establish IPSec VPN tunnels with 3rd-party products using standard IPSec protocols. This interoperability is important to compliment customers’ legacy setup and enable business operations in multi-vendor networks. We have sample guides for inter-working with Fortinet and Cisco Meraki. This document details how to set up Spoke-to-Spoke VPN tunnels between RansNet and Cisco IOS routers.
Cisco DMVPN combines “GRE over IPSec” and NHRP and dynamic routing technologies, and allows peers to auto establish VPN tunnels directly. But there’s a huge dependency – each peer must have reachability to each other, either directly over public IP or indirectly (from behind another NAT device). In real life, many branch routers do not have public IP addresses due to Carrier-grade NAT, especially when connected via 4G/5G.
So the alternative is to use spoke-to-spoke topology, eg. the spokes will route through the hub. In this topology, only the hub needs a static IP address and the spokes are flexible to have any form of WAN IP addresses, as long as they can reach the hub IP. Please refer to this link for the various VPN topologies we can support.
It is extremely easy to use the RansNet SD-WAN orchestrator to build a spoke-to-spoke VPN topology among RansNet routers. But this document is to demonstrate interoperability, so we use a Cisco IOS router as the VPN hub, and remote branches use RansNet SD-Branch (HSA/UA/CMG) routers.
Usually, configuring “GRE” over IPSec ” among Cisco IOS routers is a very complex task. But our SD-WAN orchestrator can still help to simply the configuration, for the RansNet routers.
There are a few key concepts to this configuration:
- We will provision a dummy hub gateway on mfusion and create an IPSec VPN instance to emulate RansNet Gateway VPN settings, and assign all branch routers to the gateway VPN instance, like how we would do for typical RansNet SD-WAN provisioning.
- All VPN and routing configurations for the RansNet branch routers will be centrally generated and pushed, with just a few clicks.
- How “GRE over IPSec” works
- Configure IPSec tunnels between hub and spoke using external WAN IP addresses. Use IPSec to encrypt communications between loopback IP addresses of hub and spokes
- Configure GRE tunnels using loopback IP addresses as the tunnel source and destination (therefore encrypting GRE tunnels).
- Route traffic through the GRE tunnels (therefore actual traffic is encrypted)
- On hub side (Cisco router)
- Accept all incoming IPSec tunnel request (dynamic crypto map) as long as they all have the correct pre-shared key, regardless of their source IPs
- Configure mGRE tunnel, so we don’t need to have individual tunnels for each spoke. Use static NHRP map GRE tunnel and loopback IP of each spoke.
Provisioning IOS router and Branch Routers on mfusion
Step 1: provision all branch routers and a dummy VPN gateway to mfusion. Follow this link for a detailed guide. The branch routers should be online after this step.
Step 2: import hosts to mfusion orchestrator.
Import the dummy “gateway” host to Orchestrator > Gateway, attach a “Empty” config template.
Import branch router to Orchestrator > SD-Branch, assign default template (or copy from other hosts if you already have existing configured hosts).
Step 3: On the dummy VPN gateway, create an IPSec VPN instance to emulate Gateway VPN settings
NOTE
“Gateway IP” is the publicly accessible IP of Cisco VPN gateway
Pre-shared key and Phase I & II security policies need to set the same in Cisco config
.
Step 4: Assign all branch routers to the VPN instance and configure branch (remote) network for each router.
Notice Title
If you have multiple branch routers, just assign all to the same VPN instance and change the respective branch network setting.
.
Step 5: Click “Apply Config” and all settings will be pushed to the RansNet branch routers and they will auto initiate VPN tunnels to the Cisco router. (Note: Config push to the dummy VPN gateway will fail but just safely ignore that.)
Step 6: On the branch routers, configure firewall access rules to permit VPN traffic across the tunnel (Can configure a firewall template and apply to all branch routers). NAT is auto disabled for VPN tunnel networks, no special config required.
.
.
